No description
Find a file
Suheb a005b687a7
Release 0.15.10 (#1665)
* Update version 0.15.10

* Update project dependencies to resolve Dependabot security alerts

Applies the fixes from the open Dependabot PRs (#1648, #1649, #1650) in a
single pass on the release branch, regenerating the lockfile from scratch.

axios 1.16.0 -> 1.18.1 was the only production exposure (10 advisories).
Transitive deps moved to their fixed in-range versions (fast-uri 3.1.4,
form-data, qs, tough-cookie, tar, del, globby); dev toolchain took safe
bumps (nodemon 3.1.14, eslint 9.39.5, @typescript-eslint 8.65.0).

Drops the unused protractor devDependency: no e2e directory, no config and
no e2e target in angular.json, but 100 packages and the deprecated request
stack behind it. That clears both critical advisories.

npm audit: 50 (2 critical) -> 29 (0 critical); production deps 1 -> 0.
Remaining findings are dev-only tooling needing an Angular 21 migration
rather than a version bump.

Verified: lint, 204 frontend specs, backend + frontend production builds,
and 19 API checks against the docker regtest fixture covering LND, Core
Lightning and Eclair (getinfo, channels, peers, invoices, payments and
forwarding history).

* Fill in PR number in release note (#1653)

* Harden login request validation (#1654)

Tightens server-side validation of authentication requests, guards the password-reset route behind an authenticated session, and wires the backend regression suite (test/backend/) into npm run test. Users with two-factor authentication enabled are encouraged to update promptly.

Verified: backend specs 12/12, lint green, frontend specs 204/204, and the full authentication matrix end-to-end on the docker regtest fixture.

* Reduce exposure of authentication secrets in logs and config responses (#1659)

* Reduce exposure of authentication secrets in logs and config responses

* Fill in PR number in release note (#1659)

* Harden redaction helpers and secret restore paths

* Pin deployment auth switches server-side and harden settings persistence

* Contain backup file reads and harden config persistence

* Pin backup containment root and preserve config file mode on save

* Update Angular framework packages to 20.3.27 (#1661)

* Update Angular framework packages to 20.3.27

Batches the three Dependabot PRs open against master for the Angular framework
(@angular/core #1658, @angular/compiler #1657, @angular/common #1655) into one
update on the release branch. The framework packages are pinned to exact
versions and their peer ranges require them to move together, so all nine
20.3.26 packages go to 20.3.27: animations, common, compiler, compiler-cli,
core, forms, platform-browser, platform-browser-dynamic and router.

Patch-level upstream fixes only, no advisories. The update stays inside Angular
20 - @angular/build and @angular/cli (20.3.32) and @angular/cdk/@angular/material
(20.2.14) are already at the top of their v20 lines - so it does not pull in the
Angular 21 migration tracked by #1650.

Rebuilt frontend/ for the new framework code. backend/ is unchanged, as no
server/ source moved.

* Fill in PR number in release note (#1661)

* Bound remaining unbounded alias-resolution fan-outs in LND graph.ts and channels.ts   Fixes #1630 (#1651)

* Bound remaining unbounded alias-resolution fan-outs in LND graph.ts and channels.ts

Fixes #1630

* Address review feedback: fix options race, error handling, release notes

* Improve release notes entry to cover full PR scope

* Address review feedback: per-task options copy, exclude qs from alias requests

* Stop logging the eclair auth header at DEBUG level (#1664)

* Stop logging the eclair auth header at DEBUG level

getChannels in the eclair channels controller logged its whole request
options object. Eclair authenticates with HTTP basic auth, so those
options carry the configured lnApiPassword in an authorization header -
raising an eclair node's logLevel to DEBUG wrote
"authorization":"Basic <base64>" into the node log file, which is a
recoverable form of the credential and is routinely shared when
debugging.

The log now carries only the request url and form, matching every other
DEBUG log in the controllers. This was the only site in server/ passing a
whole options object to the logger; the rest log options.form, .url,
.body or .qs, none of which hold credentials.

Present since 0.12.0 and only reachable by opting in to DEBUG (the
default log level is ERROR), but it contradicted the logging guarantee
stated for #1659.

Found by scanning node logs at DEBUG while verifying the 0.15.10 branch
against the regtest fixture. Regression test added in
test/backend/eclair-channels.test.mjs; it fails on the previous code with
"auth header key must not reach the node log".

* Fill in PR number in release note (#1664)

---------

Co-authored-by: Osuji <weezdomosuji@gmail.com>
2026-08-03 22:49:14 -07:00
.claude/skills/rtl-docker-fixture Add rtl-docker-fixture Claude Code skill 2026-07-25 10:13:59 -07:00
.github Link the release notes folder from the README 2026-07-19 22:01:23 -07:00
backend Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
docker Add a topology diagram to the docker fixture README 2026-07-19 22:01:23 -07:00
frontend Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
release-notes Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
server Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
src Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
test/backend Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
.dockerignore update .dockerignore (#1514) 2026-02-01 09:06:07 -08:00
.editorconfig Release 0.10.0 (#571) 2020-12-20 18:36:04 -05:00
.eslintrc.json Update project code according to dependencies update 2026-02-01 09:06:07 -08:00
.gitattributes Initial commit 2018-09-14 21:31:01 -04:00
.gitignore Side Navigation collapse bug fix 2026-02-01 09:06:07 -08:00
angular.json Lint Fix (#1408) 2024-06-10 16:41:37 -07:00
CLAUDE.md Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
CONTRIBUTING.md Document the Dependabot dependency-update process in CONTRIBUTING.md 2026-07-19 22:01:23 -07:00
Dockerfile Upgrade nodejs to v22 (#1515) 2026-02-01 09:06:07 -08:00
eslint.config.js Lint Fix (#1408) 2024-06-10 16:41:37 -07:00
LICENSE Update copyright year in LICENSE to 2018-2026 2026-05-02 12:16:26 -07:00
package-lock.json Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
package.json Release 0.15.10 (#1665) 2026-08-03 22:49:14 -07:00
rtl.js Release 0.15.1 (#1406) 2024-06-10 12:40:37 -07:00
Sample-RTL-Config.json Release 0.15.1 (#1406) 2024-06-10 12:40:37 -07:00
tsconfig.json Drop crypto-browserify polyfills by moving 2FA TOTP to WebCrypto 2026-07-19 22:01:23 -07:00

Ride The Lightning (RTL)

Known Vulnerabilities license

Intro -- Application Features -- Road Map -- Application Configurations -- Core Lightning -- Eclair -- Contribution -- Release Notes

Introduction

RTL is a full function, device agnostic, web user interface to help manage lightning node operations. RTL is available on LND, CoreLightning and Eclair implementations.

  • Core Lightning users, refer to this page for install instructions.
  • Eclair users, refer to this page for install instructions.
  • LND users, follow the instructions below

Pre-requisite for running RTL is a functioning and synced LND node. If you are a Raspberry Pi or a Linux user, you can follow the famous Stadicus's guide to setup a Bitcoin + Lighting node.

RTL is available on the below platforms/services:

Docker Image: https://hub.docker.com/r/shahanafarooqui/rtl

Architecture

Prerequisites

  • Functioning and synced LND lightning node.
  • Node.js, which can be downloaded here
  • Recommended Browsers: Chrome, Firefox, MS Edge

Installation

To download a specific RTL version follow the instructions on the release page

To download from master (not recommended):

First time setup

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL
$ npm ci --omit=dev --legacy-peer-deps

Or: Update existing dependencies

$ cd RTL
$ git reset --hard HEAD
$ git clean -f -d
$ git pull
$ npm ci --omit=dev --legacy-peer-deps

Prep for Execution

RTL requires its own config file RTL-Config.json, to start the server and provide user authentication on the app.

Advanced users can refer to this page, for config settings required to manage multiple nodes

  • Rename the file Sample-RTL-Config.json to RTL-Config.json located at./RTL.
  • Locate the complete path of the readable macroon file (admin.macroon) on your node and the lnd.conf file.
  • Modify the RTL-Config.json file per the example file below

Example RTL-Config.json:

{
  "multiPass": "password",
  "port": "3000",
  "defaultNodeIndex": 1,
  "dbDirectoryPath": "<Complete path of the folder where rtl's database file should be saved>",
  "SSO": {
    "rtlSSO": 0,
    "rtlCookiePath": "",
    "logoutRedirectLink": ""
  },
  "nodes": [
    {
      "index": 1,
      "lnNode": "LND Testnet",
      "lnImplementation": "LND",
      "authentication": {
        "macaroonPath": "<Complete path of the folder containing LND admin.macaroon for the node>",
        "runePath": "<Complete path including filename for CLN rune for the node, rune format 'LIGHTNING_RUNE="your-rune"'>",
        "lnApiPassword": "<Can be used to provide password in ECL implementation>",
        "swapMacaroonPath": "<Complete path of the folder containing Loop's loop.macaroon for the node>",
        "boltzMacaroonPath": "<Complete path of the folder containing Boltz admin.macaroon for the node>",
        "configPath": "<Optional:Path of the .conf if present locally or empty>",
      },
      "settings": {
        "userPersona": "OPERATOR",
        "themeMode": "DAY",
        "themeColor": "PURPLE",
        "channelBackupPath": "C:\\RTL\\backup\\node-1",
        "bitcoindConfigPath": "<Optional: path of bitcoind.conf path if available locally>",
        "logLevel": "INFO",
        "fiatConversion": false,
        "unannouncedChannels": false,
        "lnServerUrl": "<url for LND REST APIs for node #1 e.g. https://192.168.0.1:8080>",
        "swapServerUrl": "<url for swap server REST APIs for the node. e.g. https://127.0.0.1:8081>",
        "boltzServerUrl": "<url for boltz server REST APIs for the node. e.g. https://127.0.0.1:9003>",
        "blockExplorerUrl": "<url for local or centralized block explorer. e.g. https://mempool.space>"
      }
    }
  ]
}

For details on all the configuration options refer to this page.

User Authentication on RTL

RTL requires the user to be authenticated by the application first, before allowing access to LND functions. Specific password must be provided in RTL-Config.json (in plain text) for authentication. Password should be set with multiPass:<user defined> in the Authentication section of RTL-Config.json. Default initial password is password.

For hosted solutions such as BTCPayServer, we implemented an "SSO" setup using a one-time-use cookie. For other vendors which have their own authentication service, we introduced a "disableAuth" option, which disables authentication at the RTL level. When using this option, the authentication security is the responsibility of the Vendor. This option is NOT recommended for standalone users of RTL.

Start the Server

Run the following command:

$ node rtl

If the server started successfully, you should get the below output on the console:

$ Server is up and running, please open the UI at http://localhost:3000 or your proxy configured url.

Optional: Running RTL as a service (Rpi or Linux platform users)

In case you are running a headless Rpi or a Linux node, you can configure RTL as a service.

  • Create RTL systemd unit and with the following content. Save and exit.
# Raspibolt RTL: systemd unit for RTL
# /etc/systemd/system/RTL.service

[Unit]
Description=RTL daemon
Wants=lnd.service
After=lnd.service

[Service]
ExecStart=/usr/bin/node <Full path of the RTL folder>/rtl
User=<user>
Restart=always
TimeoutSec=120
RestartSec=30

[Install]
WantedBy=multi-user.target
  • enable and start RTL
$ sudo systemctl enable RTL
$ sudo systemctl start RTL
  • montior the RTL log file in realtime(exit with Ctrl-C)

$ sudo journalctl -f -u RTL

Accessing the Application

You can access the application in multiple setups (Please make note of the 4th exception):

  1. Same device as the server: Open your browser at the following address: http://localhost:3000 to access the RTL application.

  2. Remotely from another device on the same local network (home network) as the node(RTL server+LND running on the same device):

  • Ensure that the if a firewall running on your node, it allows access on port 3000 (or the custom port configured for RTL).
  • Determine the IP address of your node to access the application. E.g. if the IP address of your node is 192.168.0.15 then open your browser at the following address: http://192.168.0.15:3000 to access RTL.
  1. Config tweaks for running RTL server and LND on separate devices on the same network can be found here.

  2. Any Other setup: Please be advised, if you are accessing your node remotely via RTL, its critical to encrypt the communication via use of https. You can use solutions like nginx and letsencrypt or TOR to setup secure access for RTL.

  • Sample SSL setup guide can be found here
  • (For advanced users) A sample SSL guide to serve remote access over an encrypted Tor connection can be found here

Troubleshooting

In case you are running into issues with the application or if you have feedback, feel free to open issues on our github repo. You can also reach out to us via twitter DM on @Suheb__ or @RTL_App. Thanks for your interest.